As a committed operational risk professional, I cannot help but stare in amazement amidst all the financial ruin and desolation that surrounds us. The hand wringing and the weeping about credit risk, liquidity problems, lack of trust and the like are all
smoke. And this smoke conceals the true cause, in my view, of all the current problems. It all points to massive failure in operational risk management, right the way through from where the first cracks appeared last summer in the sub-prime mortgage crisis
to the collapse of the investment banks a year later, plus all the panic and pain that has followed.
Now, before everyone jumps down my throat let me explain.
The Basel II definition of operational risk is "...risk of loss resulting from inadequate or failed internal processes, people and systems or from external events". (Paragraph 644 of the Basel II Accord). Building further on the Basel II theme, not only
does the Basel Committee encourage the use of their "Sound Practices for the Management and Supervision of Operational Risk" for the "Basic Indicator Approach", the criteria for both the "Standardised Approach" and the "Advanced Measurement Approaches" are
that "at a minimum" (1) the bank's board and senior management must be actively involved in the overseeing it's operational risk management framework, (2) the bank must have an operational risk management system that is sound and (3) that the bank sufficient
resources to use this approach in its main business lines plus its control and internal audit areas.
Now let's take a step back to "Sound Practices for the Management and Supervision of Operational Risk" which was published in February 2003. If we look at the section "Risk Management: Identification, Assessment, Monitoring, and Mitigation/Control" we find
that it contains three principles. And these three are key to my whole theses. Principle 4 states;
"Banks should identify and assess the operational risk inherent in all material products, activities, processes and systems. Banks should also ensure that before new products, activities, processes and systems are introduced or undertaken, the operational
risk inherent in them is subject to adequate assessment procedures".
And herein lays the answer to all the current woes that we are afflicted with. If these new weird and wonderful products and processes had been correctly examined we would not be in the predicament we now find ourselves in.
And all this is apart from the initial three principals contained in the document which clearly charge the bank board with developing, maintaining and monitoring the appropriate operational risk management environment.
Unless banks are truly committed to managing operational risk we are going to see this problem repeated, in one guise or another, again and again.